
P2P Information 
Disclosure 



or 



Identity Theft via P2P Networks is as Easy as Clubbing 

Baby Seals 



What this is all about 



Preliminary research for pen- 
testing 

• Was there anything good still 
out there? 

• How is our education 
working? 

• How stupid/uneducated 
are people? 

Cleaner than actually clubbing 
baby seals... 




Why is this like 
clubbing baby seals? 



Easy! 

Only a little patience 
needed 

Quick results 

Legal, yet morally/ 
ethically dubious 




'm not dead yet! 



gnutella is still 
around 

While usage appears 
to have declined, use 
is still high enough 
to warrant attention. 

Ratio of clueful users 
dwindling? 




Some Inspiration 



The old seewhatyoushare.com 
project 

http://web.archive.org/web/*/http.7/ 
seewhatyoushare.com 

Joint Strike Fighter information 
release 

• Well, at least what we hear... 



Continued stories on data 
exfiltration through P2P network: 

• 2/29/09 - Krebs, Washington 
Post, Missile silos and Michelle 
Obama's safe house 






Lockhwd Martin F-35B (STOVL) 

JOINT STRIKE FIGHTER 
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Our search methods 



. "* 



Use a bunch of search terms 

• "evil" and or common sense 
file names 

• specific document extensions 

• combinations of the above 

Some combinations return too 
much (with other interesting 
results), and some return too little 

Really a great opportunity to get 
creative 




Insert search terms 

here 

Just a few of the concepts/terms we used: 
Terms Filenames 



word 

doctor password.txt 

health TaxReturn.pdf 

passwd passport.jpg 

password visa.jpg 

lease license.jpg 

license signons2.txt 

passport signons3.txt 
visa 



Extensions 


.pst 

• cf g 

.pcf 


.qmd 
.qsd 


.doc 


.qtx 




.idx 


.docx 




.xls 


.qif 


.xlsx 


.mny 




.ofx 


.pdf 


.ofc 


.tax 




.qdb 


.txt 



What next? 



• Automated, repetitive 
searching 

• Build better search criteria/ 
evilness 

• Searches limited to 
appropriate IP ranges for 
client networks for use pen- 
testing/targeted attacks? 

• More on this in a few slides. 




P2P-NG? 



MPAA & RIAA are driving 
P2P networks 
underground 

"Next Gen" P2P *will* 
have encrypted traffic 

• but if you are a 
"member"... 

• Anti-leech features will 
exacerbate over-sharing 




And now... 



Some results... 
.aside from music, movies, tv shows... 



And now... 



Some results... 
.aside from music, movies, tv shows. 

...and prOn... 



And now... 



Some results... 
.aside from music, movies, tv shows. 

...and prOn... 

...lots & lots of prOn! 



And now... 
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Unexpected finding... 



• Malware! 

• We knew there was malware, just 
not how much 

• Oh hell yeah, every thing we 
searched for we had an answer 
to... 

• Expected first 8 - 1 2 hits to be 
malware! 

• Got suspicious of all files 3.2 -3.8 
MB 

• All downloaded fast, and had a 
setup.exe 




Owned! 



File unknown received on 10. 23.2D08 19:55:03 (GET) 
Current stalus: tini-sti«d 
Result: 3S/35 (97.22%) 
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RriM rnsulls fc. 


AMU 


Vftrtlfin 


LHtUpdtt* 


Rttull 




N 


fthnL*b-v3 






■ [RCBct.worm.variiJit 
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Worn/ IrcBot .290916 
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W32/3ackriaor2. -d- 
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- 


- 
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Bug kdoo r . Ki n 32 . IBCBftt 


era 


KwpoirtX'y 


- 


- 


i 


4IM 


KcAfcc 


- 


- 


H32/3dbat.wDrB 




Mior*«rft 


- 


- 


Mc kdoa z : h i n 32 .'liot 




n-:-:-.. 


- 


- 


prebibly * v* tUfit ef winSS/Genet ;k 


ferw 


- 


- 


w32 / : rcbLiL . f s:-: 




i'ar.da 
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k^ VIRUS 
^ TOTAL 



Viruslotal is a service that analyzes suspicious 
files and facilitates the quick detection of viruses, 
worms, trojans, and all kinds of malware 

detected by antivirus engines. . 



File has already been analysed: 



Date: 
RMttLtl : 

PermaLink: 



5 Bi S 3b4c 1 cb £4 c i dG7 caO Ibl QaaD 96£d 
03.21,23=8 frlilli&g (CETJ 

io.23.2Sca iat5St03 (cetj [>2odd] 

3B/36 
aflftliai*7dhfjril61dai0 J Mrfrt350T'c-441Eld0* 



Sf-ow a.'. 'eSQi Reanalyze hie low 



Without further ado... 



We'll start small and work our way up... 

_^ EPIC 

FAIL ^ 

FAIL 



Miscellaneous goodies 




Miscellaneous goodies 






THE 2008 CHEERLEADING WORLDS 




EVENT SCHEDULE 






K:00am- 12:00am 


Airport Arrivals 


5:30pm -6:00pm 


Buses depart from hotel for VIP Reception 


6:00pm - 9:30pm 


VIP Reception 






Saturday, April 26- Disney's Hollywood Studios ™ (Indiana Jones Theater) 


9:00am- 12:05pm 


International Junior All Girl Preliminary Competition 


9:04am -11:30am 


International Junior Coed Preliminary' Competition 


1 1:45am- 12:00pm 


International Junior Coed Finalist Announcements 



155 


Can eh 


29-Apr 


Southwest 


3221 


5:10 PM 


Shuttle 


256 


156 


Ton; 


29-Apr 


Delta 


I79t> 


6:05 PM 


Shuttle 


32;t 


157 


Sandy 


29-Apr 


Delta 


1790 


6:05 PM 


Has Tranpsortation 


SiH 


15B 


Bambi 


29-Apr 


Airtran 


460 


(r.03 PM 


Has Tranpsortation 


44- 


159 


Daniele 


29-Apr 


Delta 


iS74 


6:25 PM 


Shuttle 


413 


160 


Kavmorn. 


29-Apr 


Southwest 


SSi 


7:55 PM 


Shuttle 


504 



2008 Worlds Judges Rooming List 



Denise 
Jennifer 




24-Apr 
24-Apr 

25-Apr 

25-Apr 
25-Apr 



28-Apr 
2fi-Apr 

29-Apr 

29-Apr 
29-Apr 



Cheer 
Cheer 



Cheer 



Cheer 
Cheer 



Miscellaneous goodies 



2 
3 

~5~ 
$_ 
7 
8 
_$_ 
10 
11 

14 
15 



Stg.ij 

Denise . 

Rjos 

Jennnti 

Laeey 

Carina 

Jesa 

Eevjt 

Pre? 
Kati 
.Vlu. 



THE 2008 CHEERLEADING WORLDS 
EVENT SCHEDULE 



23-Api 



Delta 



6145 



11:55 AM 



Avis Confirm # and 

Transportation 

Has Ride 



24-Apr 
24-Apr 

24-Apr 
24-Apr 
24-Apr 
24-Apr 
24-Apg 



Delta 
Airtran 
Southwest 
Northwest 
American 
American 

Delta 



6069 
409 

3251 

1464 
1464 
1667 



8:45 AM 
1:44 PM 
2:15 PM 

4:aS PM 
6:25 PM 
6:25 PM 
10:29 PM 



HasKide 

Denise Baker 
Shuttle 

-&US4 
Lanna 
Shuttle 



2n-A;>r 
25-Apr 
25-Apr 



Alaska 
Alaska 
Delta 



10 

10 

1800 



7:30 AM 
7-30 AM 
Ml AM 



Mathew 
Mathew 
-US5 



Denise 
Jennifer 



Brian 
lk:n':e.- 





24-Apr 


28-Apr 


Cheer 




24-Apr 


2G-Apr 


Cheer 




m 


25-Apr 


29-Apr 


Cheer 






25-Apr 


2^-Apr 


Cheer 




25-Apr 


29-Apr 


Cheer 



Emergency i 
Number 




Miscellaneous goodies 



LAST WILL AND TESTAMENT 
OF 



I, HP _ residing in Cranite City, .Madison County, Illinois, 

being oT so una mina ana disposing memory, do hereby make, publish and declare this to be 
my Last Will and Testament, hereby revoking alE Wills and other testamentary dispositions 
made by me heretofore, 



ARTICLE ONE 

[ do hereby direct that my Lvecutors, hereinafter named, pay all my just debts and 
funeral expenses as soon after my death as may be convenient. My body shall be taken to 
the Irwin-Scott Chapel on Maryville Road. I want no one. other than my two children to 
view my remains. There will be no wake or funeral. Burial will be at Valhalla Cemetery in 
Belleville. IL. 



ARTICLE TWO 

I do hereby give and bequeath to my beloved daughter;, R 

my clothing, jewelry, sewing machine, Becker clock, the painting oy Carcia, 
and all personal papers owned by me at the date of my death to do with what she will 



[ do hereby give and bequeath to my son, K ., the video of 

Home Movies, because Rebecca already has a copy, ms grave lot in Valhalla Cemetery, 
Belleville, IL has already been deeded to him. taking effect at the time of my death, 

The family pictures can be looked at antf ^nch of mv children «hall keep any he or 
she wants. All the rest shall be retained by K _ to insure they are 

not lost to future generations of our family. 



ARTICLE Til RLE 



[ do hereby give and bequeath to my beloved son, K h^K, all my 

tools, my computer equipment and all Thomas villc furniture totaling 7 pes. from the 

bedroom and 5 pes. from the dining room. Any CD's floppy disks., books, files, papers 

Dcrtaining to my genealogy research will be given to my daughter, R 15 

^^■■■L. to be kept safe until someone down the Line, in our family, would want mem, to 

continue the genealogy research, then at her discretion, she may give then to that person. 



Miscellaneous goodies 



Retirement Needs 



Objective 



* Save enough for a secure mid comfortable retirement. 

Needs Analysis 



Monthly Income Goal # Benefits 




Assumption* 


Current ernploymem income 517,500 

lrtMflK gtftfl % 20H 
Income goal in today's 5 53,500 
Income goal in future 5 S5,-lW 
Social Security beufitS l\Ji.,k 
kfonlhly pension benefits I \..li .li 


Retirement Age 66 (15 >ts) 
Life fxpcccancy 95(2&yrs) 

Current retirement savings S3<000 
Current monthly savin |5 Su 

Iritlaiirtiifate 1 3$i 
ROR bcfbreftluriiiE, rttircmeni 1 2*W6% 



* Due to inflation, yout projected income need w ill be S5,45J per month the first year of jour retirement. 

* To provide your retirement income goal tew 2V years (to age 95). you need hi accumulate SI .--fMXlO by retirement 
age 66- This is your Financial Independence Number.** 

* One way to do this is to save SL77S each month and increase ibis amount 3% each year. This is S1,77S more than 
you are noiv saving. This would UKrciisc your retirement savings 10 10% of YOUf current employment income. 



The Rule of 72 



The Rule of 72 apna-oximales the number of years it 
lakes lo douMe your money, If you earn a 12% Tate 
of retum your money wo* Id double every 6 v wt, 
(72 + 129%-* years) 






Beginning 


S94JMM 


HHM0 


vj-U'ini 


Year 6 






$69,600 


Year 12 




S69J00 


$142,500 


Year 13 






S29I.7W 


Year 2:4 


So^&OO 


&141.W0 


i-:^- .-.::. 



Von hive 2 5 tfc->i*j period* «>.il y:w rrti'rrvn;. i»w*iin| 1 ;*. HfKi 



Retire HI 
A 6 c 61 



Retirement fund repaired * SI,I6J + 000 
Monthly s»i inpj needed 

at 5% before letranent, 4% during. JM99 

hi 8-% before nmrcnwnt, 5% dur ins 16. 105 

at ]1% before retirement, 6% daring S4.061 



Retire .i i 
S3 Age (64> 

$1,247,000 
U.T7S 

SI.T7* 



Retire at 
Arc 71 

$l B 27R,0OQ 

Si JO I 

5755 



Miscellaneous goodies 
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Taxpayer Identification • 



Numbers (TIN) 



Taxpayer Identification • 



Num 


bers (" 


riN) 


##*GJ\ Department of the Treasury 
Vj Tyfj] Internal Revenue Service 
KfiUll AUSTIN, TX 78714-9342 




Date of this notice: OS/1 4/2007 

Number of this notice: CP565 

Form; W-7 

Case Reference Number: 

202942 -^S? 

DOB 

For assistance call us at: 

(21S) 5 16-4848 

For international callers 

(215)516-4846 

This is not a toll-free number 






JEFFERSON CITY, MO 65101 






Or you may write to us at: 
Internal Revenue Service 
POSox 149342 
AUSTIN, TX 7871 4-9342 


WE ASSIGNED YOU AN IRS INDIVIDUAL TAXPAYER IDENTIFICATION NUMBER (ITIN) 




9i6-#-mr 





Taxpayer Identification • 



Numbers (TIN) 



s 



Department of the Treasury 
Interna] Revenue Service 
AUSTIN, TX 78714-9342 



Date of mis notice: 08/14/2007 

Number of this notice: CP565 

Form: W-7 

Case Reference Number: 

2029- 

DOB 



JEFFERSON CITY, MO 65101 



For assistance call us at: 

(215)516-4846 

For international callers: 

(215)516-4846 

This is not a toll-free number 

Or you may write to us at: 
Internal Revenue Service 
PO80X 149342 
AUSTIN, TX 78714-9342 



WE ASSIGNED YOU AN IRS INDIVIDUAL TAXPAYER IDENTIFICATION NUMBER (ITIN) 



Taxpayer Identification • 






Numbers (TIN) 



*0*G\ Department of the Treasury 
wflfll] Internal Revenue Service 
Vfla'/' AUSTIN, TX 78714-9342 


Date of this notice: 08/14/2007 

Number of this notice: CP565 

Form W-7 

Case Reference Number: 

2029*: m*t- 

DOR 


JEFFERSON CITY, MO 65101 


For assistance call us at: 

(215)5164846 

For international caifers: 

(215)516-4846 

This is not a toll-free number 




Or you may write to us at: 
Internal Revenue Service 
POBox 149342 
AUSTIN, TX 78714-9342 



WE ASSIGNED YOU AN IRS INDIVIDUAL TAXPAYER IDENTIFICATION NUMBER (ITIN) 

916- 



Taxpayer Identification • 



Numl 


3ers ( 


TIN) 


lg*ffts Department of the Treasury 
W jjflj Internal Revenue Service 
NMa'/l AUSTIN, TX 78714-9342 




Date of this notice: 08/1 4/2007 
Number of thjs notice: CP5G5 
Form: W-7 
Case Reference Number: 

"vii mm 

DOB 


m W& 
JEFFEHSON CITY, MO 65101 




For assistance call us at: 

(215)516-4846 

For international callers: 

(215)516-4846 

This is not a toll-free number 


it 




Or you may write to us at: 
Internal Revenue Service 
POBox 149342 
AUSTIN, TX 78714-9342 


WE ASSIGNED YOU AN IRS INDIV1DUALTAXPAYER 


IDENTIFICATION NUMBER {ITIN) 




916-% JM 





Taxpayer Identification • 



Numbers (TIN) 



*^*<3V De P artmerrt °' tne Treasury 


Date of this notice: 08/14/2007 


wTyfl) Internal Revenue Service 


Number of this notice: CP565 


%&&l> AUSTIN, TX 78714-9342 


Form: W~7 




Case Reference Number: 




20294MW 




DOB 






* K. 


For assistance call us at: 
(215)516-4846 

For international callers: 






JEFFERSON CITY, MO 65101 


(215)516-4846 




This is not a toll-free number 




Or you may write to us at: 




Internal Revenue Service 




POBox 149342 




AUSTIN, TX 78714-9342 



WE ASSIGNED YOU AN IRS INDIVIDUAL TAXPAYERIDENTIFICATION NUMBER (ITIN) 

916 * •% 



Taxpayer Identification • 



Numbers (TIN) 



fi 



Department of the Treasury 
Internal Revenue Service 
AUSTIN. TX 78714-9342 



Date of this notice: OS/1 4/2007 
Number of this notice; CPS65 
Form; W-7 
Case Reference Number; 

i i !■ ^m 

DOB 



JEFFERSON CITY, MO 55101 



For assistance call us at: 

(215)516-4846 

For international callers 

(215)516-4846 

This is not a toll-free number 

Or you may write to us at: 
Interna] Revenue Service 
POBox 149342 
AUSTIN, TX 7871 4-9342 



WE ASSIGNED YOU AN IRS INDIVIDUAL TAXPAYER IDENTIFICATION NUMBER (ITJN) 



Taxpayer Identification • 



fi 



Numbers (TIN) 



Department of tt 
In tern aJ Revenu* 
AUSTIN. TX78J 



JEFFERSON CI 



WE ASSIGN 




his notice: 08/14/2007 

of this notice : CP565 

-1 

'ference Number: 



stance call us at: 
6-4846 

ational callers 
S4S46 

t a toll-free number 

lay write to us at: 
Revenue Service 

149342 

TX 7871 4-9342 

J NUMBER (ITIN) 



Turbo Tax Returns 




Turbo Tax Returns 



Departrrenl oF "he Treasury — Nema Revenue Service 

U.S. Individual Income Tax Return 



2008 



|(99j 



IRS Use Oily - 




Dc not ■.'.- 1c c - ifiic l- n L" i^. iCL^L-. 



Label 

;See hslruclions.) 

Use the 
IRS label. 

Otherwise, 
please print 
or type. 

Presidential 

Election 

Campaign 



Fct (lie year Jan 1 - Dec 31 , 2QQB, op other lax year beginning 



Your 1rsl name 



If a joint relu _ ! 



Ml Last name 



, 2006. fe nding 



_jn_ 



n. spouse's First narre 



Ml Last name 



Home acdress fnu^ jb _ a-d sreetj. If you have a P.O. box, see instrument*. 



Apartment no. 



Cty. Imn or post ohice. II you .isve i c-sig - ' adc _ 3ss, see i-slrLclicns. 

TROY 



State ZIP code 
MI 4S0S4 



OMB No. 1S4G-C074 



Your social security number 

368- _T 



Spouse's social s 

332- 



You musi enter your 
, social security . 
A number(s) above. A 



C'ierj<inga pox below will noi 
change yo una* op refund. 



^ Check here II you r o# your spouse il tiling joinily, want S3 to go to this lund? (see inductions}. , * |_|you _|Spojse 



4 | J Head ot household (with qualifying person), (See 
instructions.) If the qua lining person is a child 
but not your dependent, enter this child's 
name here *- 



Filing Status 



Check only 
one box. 



Single 

Married tiling jointly (even il only one had income) 
Married tiling separately. Enier spouse's SSN above & h 
name here- *- 



5 ~| Qjaiiiyhg widow-eh wivi uupnujul chili; :suu -nsL-jctionsi 



Exem pti O n S 6a X_ Yo u rself . r someon e can cl ai m you as a dep end ent, d o n ot chec k box &a . 



Spouse 



> 



c Dependents: 



(1 } First name 



Last name 



L== 



If more than 
four dependents, 
see instructions. 



(2) Dependent's 

social security 

number 



(3) Dependent's 

relationship 

to you 



379- 



379^ : 



Daughter 



quality™ " ¥au 

child For child with you 



ffo. of children 
on 6c who: 
Tived 



tax o-ed;l 
(see instrs) 



_E_ 



_E_ 



n 



n 



• did net 
live wrth you 
due to drvorce 
or separation 
[see instrs) ■ . 
Dependents 
on 6c not 
enlered above - 



d Total number of exemptions claimed - , ,,...., above 



Inrnmc 



7 Wages, salaries, tips, etc. Attach Form(s) W-2 ■ 



392,323, 




Turbo Tax Returns 



Departrrenl oF "he Treasury — hlema Revenue Service 

U.S. Individual Income Tax Return 



2008 



|(99j 



IRS Use Oily - 




Dc noL ■.'.- 1c c - ifiic l- n L" i^. iCL^L-. 



Label 

;5ee hslruclions.) 

Use the 
IRS label. 

Otherwise, 
please print 
or type. 

Presidential 
Election 



Fct (lie year Jan 1 - Dec 31 , 2QQB, op other lax year beginning 



Your fi-il name 



If a joint relu _ ! 



Ml Last name 



, 2006. fe nding 



_jn_ 



n. spouse's First narre 



Ml Last name 



Home acdreaa murine - a-d sreetj. If you have a P.O. box, see instrument*. 



Apartment no. 



Cty. Imn or post ohice. II you .isve i c-eig-' adc-ess, see i-slrLclicns. 

TROY 



State ZIP code 
MI 48084 



OMB No. 1S4G-C074 



Your social security number 

368- _T 



Spouse's social s 

332- 



You musi enter your 
, social security . 
A number(s) above. A 



C'luctirrga pcx below will noi 
chaigryoif tax of refund. 



Campaign ^ Check hef e II you, cr your spouse il lilina joinily. wai>t S 3 to rjo Eo lhi& lund? (see ins-lfuciions) - . ** |_|You |Spojse 



4 | J Head ot household (with qualifying person), (See 
instructions.) If the qua lining person is a child 
but not your dependent, enter this child's 
name here * 



Filing Status 



Check only 
one box. 



Single 

Mailed tiling jointly (even il only one had income) 
MaiPl&d tiling separately. Enier spouse's SSN above & h 
name lere . *- 



5 ~| Qjalilyhg widow-epj wiM liuli^iu jtiI chili; -jsuu -iisL-jctionsi 



6a |xj You rselMf someone can claim you as a dependent do rot check box 6a | 



Exemptions 

File by Mail Instructions for your 2008 Federal Tax Return 

Important: Your taxes are not finished until all required steps are completed. 

(If you prefer, you can still e-file. Go to the end of these instructions for 
more informatics ' 



TurboTax 





DR 


TROY , MI 


48084 


Balance 

Due/ 

Refund 


1 

1 Your federal tax return (Form 1040) shows you are due a refund of 
1 $3,264.00. Your refund will be direct deposited into the following 
1 account: Account Number: 3 795, Routing Transit Number: -r791. 



Turbo Tax Returns 



Department oflhe Treasury — Interna 'Revenue Service 



Form 1 040 U.S. Individual Income Tax Return 2008 I (99) ^^0^-00^*™^*^^. 



i 



Label 

(See i-filruclicnE.) 



Fc 1 f-i yaa 1 Jiir 1 - Doc 31. 2GGB. or uhcf laxyuar bug mi ny 



, £00 fl, ertdjrig 



,20 



YnuMirsl name 



Ml Last na-^= 

B 



If a pinl rslu-n, spouse's First name 

Use trie 
IRS label. 

Otherwise, Home address [number and street), ir you have a P.O. bos, sbb instructic-s. 

please print 
or type. 



Apartment no. 



Presidential 
Election 



- iy. lev, " (j- D3Et ohcc h you nave a J u _ eig- adc _ est, see i is-lruc-lions. 

Clovis 



State ZIP code 

CA 93611-0000 



QMBNd. 1S45-O074 



Your soci-ar security number 

367- W* 



Spouse's social security number 



You must enter your 
. social security , 

* number(s) above. A 



Cm-dry a djk ixibw will ret 
change your lax op pefurrd. 



Campaign ^ Check here- II you. Of your spouse illillngjoinlly, want 13 logo to this lund? (see insUuclions} * |ZI YoLI ~~ I Spouse 



Pilinsi Cte4ne 1 



I Single 



A |X I Head ot household (with qualifying person). (See 



Electronic Filing Instructions for your 2008 Federal Tax Return 

Important: Your taxes are not finished until all required steps are completed. 



TurboTax 



B 



CloviB, CA 93611-0000 



Balance 

Due/ 

Refund 



Your federal tax return (Form 1040) shows a refund due to you in the 
amount of $466.00. Your tax refund should be direct deposited into 
your account within 8 to 14 days after your return is accepted s 

Account Number: 541270 Routing Transit Number; 72594, 






Turbo Tax Returns 



Form 



1040 



Departrrsnl of Ihe Tre^sur y — Interna Hevenue Service 

U.S. Individual Income Tax Return 



2008 



Label 

iSae instructions.) 

Use the 
IRS label. 

Otherwise, 
please print 
or type. 

Presidential 

Election 

Campaign 



1(99) 



\-:3 .':>_ £" v — I':: -::i v. x l" v^l i- -i i-"s-j[:l.-:l\ 



For (he year Jan 1 - Dec 31, 2DDB, or other to year beginning 


. 200B, ending 


,20 


OMB No. 1545-0074 


Your Irsl name Ml 


Last name 






Your social security number 

545- 




IF a joint ralurn, spouses Firsd name M 1 


Last name 
b 






Spouse's social security number 

557- - 


Homa acdress (number and El-eat)- If you have a P.O. box, sea instructions. 




Apartment no. 


You must enter your 



j navea'ci-ic- ivjc ■ i-j-s. lice hslruClions. 



ir.odesxo 



Stats ZIP cede 

CA 95355 




social security 
m number(s) above. A 



Checking a box below will not 
change your to or relu rid. 



^ Check heie II you, or your spouse il Tiling joinily, want S3 to go to this fund? (see insertion: 



* Qyou ^Spouse 



Filing Status 



Check only- 
one box. 



Single 

Waffle d tiling jointly (even il only one had income) 
Married ling separately. Enler spouse's SSN above 
name here. *• 



4 J Head o + household (with qualifying person). (See 
instructions.) If the quali^inc person is a child 
but not your dependent, enter this child's 
name here * 



5 | ] Qualifying wiJuwiefj wih depend en I chile (see instructions) 



Exemptions 



6a 

b 



Yourself. It someone can claim you as a dependent do not check box 5a, 
Spouse 




c Dependents 

{1} First name 



If more than 
four dependents. 



Turbo Tax Returns 



Dapartmenl of Jhe Treasury — Internal Revenue Service 

Fom 1 040A LLS, Individual Income Tax Return s?: 2008 



IHS Use Only — Co vj: -■■•- I:- o r sl&u'c - ?t j sjdtx 






Label 

(Sea i -islruclions.) 



Use the 
IRS label. 

Otherwise:, 
please print 
or lyoo. 



Presidential 



--ou- 'r-A "-ame a--d in :i^i 



Mr. 



If a join! return, spouse's ffrsl name and initial 



Home address (number and si reefy. If you fiava a P.O. box, see instructions. 

Drive 



On>', iowtt or post office, tt you hava a foreign address, sea instructions.. 



Ludington 



State ZIP coda 

MI 49431-0000 



OMB Nd. 1 545-0074 



Your sociaf security number 

370- 



Spouse's social security number 



^ You must enter ^ 
your SSN(s) above 



Checking a box below will 

not change your 

tax or refund 



Turbo Tax Returns 



Dapartmenl oF Ihe Treasury — Internal Revenue Sarvce 



Form IU4UW 


i u.b. individual income lax Heturn 


(99} £ 


uuo 


IRS Use Only - 


- Do nol write or staple in this space. 


Label 


You- "first name aid in lia! Last nane 

Tooir.an, 


Mr. 








OMB Nd. 1 UA5-C07A 


(Sea i -is-lruc-lions.) 


Your sociar security number 

370- 


Use the 
IRS label. 

Otherwise, 


If a join! return, spouse's firsl name and initial Last name 


Spouse's social security number 


ptease print 
or lype. 


Home address {number and sJreet). If you have a P.O. box, see instructions. 

2603 N. -^ Drive 






Apa-lment no. 




^ You must enter ^ 
your SSN(s) above 




Cily, town or post ottice. tr you have a foreign add nets, sea instructions. 




State 


ZIP coda 




Checking a box below will 






Electronic Filing Instructions for your 2008 Federal Tax Return 

Important: Your taxes are not finished until all required steps are completed. 




TurboTax 



Ludinqton, MI 



Mr. 
Drive 
49431-0000 






Balance 

Due/ 

Refund 



Your federal tax return (Form 1040A) shows a refund due to you in the 

amount of $741.00. Applicable fees were deducted from your original 
refund amount of $741,00, Your refund is now $6 61,15, Your tax refund 
should be direct deposited into your account within R to 14 days 
after your return is accepted: Account Number: ^420 012 Routing 
Transit Number: 32511 



Turbo Tax Returns 



Department oi the Treasury — Internal Revenue Service 

Form 1 040 U.S. Individual Income Tax Return 2006 



(99) IRS Use Only — Do no"! -.v-ji^ o r slau'c ■■■ r\ j sjacc. 





Forihe ve^r Jan l - Dec 31. 2033 t 1 alhr'axysjar :e ginning 


, 2006, ending 


,20 


OWBNo. 1545-0074 


Label 

(See instructions.) 


Your First name Ml Last name 


Your social security number 

149 — 


Use the 
IRS label. 


If a joint return, spouse's 1irat name Ml Last name 


Spouse's social security number 


Otherwise, 
please print 
or type. 


M"^.c- address (lumber and street). 11 you have s P.O. box, see ns1-uctons. 




Apartroenl no. 


You must enter your 

social security 

A number(s) above. A 




City, town or post d1Fc-b. IF you nave a Fore gn aodress. see instructions. 

East Stroudsburg 


Slale 

PA 


ZIP code 
18301 


Presidential 
Election 


Checking a box below will not 
change you* tax wwftjnd. 

fwlw-.. 1 !* 


L. r. ■ ■.*<!< 


■ 















File by Mail Instructions for your 2006 Federal Tax Return 

Important: Your taxes are not finished until all required steps are completed. 

(If you prefer, you can still e-file. Go to the end of these instructions for 

more information > 
_ w. <« 

Last S-crouaSDurg, PA 18301 



TurboTax 



Balance 
Due/ 

Refund 



I 

I Your federal tax return (Form 104 0) shows you are due a refund of 

I $10,073.00 



Turbo Tax Returns 



ELECTRONIC POSTMAKK - CERTTFI 
TAXPAYER: T A 

PRIMARY SSN: d46- 



Electronic Filing Instructions for your 2007 Federal Tax Return 

Important: Your taxes are not finished until all required steps are completed. 



TurboTax 



Declaration Control Numbe^ 

Street 

L'Anse, MI 49946-0000 



apted: 02/03/2008 



Balance 

Due/ 

Refund 






Your federal tax return (Form 1040) shows a refund due to you in the 
amount of $2,571.00, The IRS estimates that you can expect your tax 
refund to be direct deposited into your account between 2/15/200 8 
and 02/19/2 00S. This is only an estimate. Account Number: 67 975 

Routing Transit Number: 123 > 



2007 

Federal 

Tax 

Return 

Summary 



Adjusted Gross Income 


* 


103 


,039.00 


Taxable Income 


$ 


80 


,080.00 


Total Tax 


$ 


12 


,B6G.O0 


Total Payments /Credits 


* 


15 


,437.00 


Amount to be Refunded 


$ 


2 


,571.00 


Effective Tax Rate 






12.49% 



Turbo Tax Returns 



Electronic Filing Instructic 

Important: Your taxes are not fin 

Declaration Control Numbe 

Street 

L f Anse, MI 49946-0000 



Balance 

Due/ 

Refund 






Your fede 
amount of 
refund to 
and 02/19 

Routing T 



2007 

Federal 

Tax 

Return 

Summary 









i due to you in the 
an expect your tax 
itween 02/15/2008 
Number; 67 975 



103,039.00 

80,080.00 

12,B6G.O0 

15,437.00 

2,571.00 

12.49% 



Social Security Cards 



Social Security Cards 



ip ih* ™b *fth you, pfcwupal Etcc*^ Tht «tf«r «de a*T^i Import.* 






LANE 



YOUR SOCIAL SECT 

Detach to curd bdo>; ftnd sign il ir. :n« icnmcotaly 
Keep vour card in a S3& pl"'^' tc previrrv. io** rr lh- 
DONO'l OVftRY IT WITH YOU. 
Do i"i o l Laminate your cart-. 




Social Security Cards 
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Visitation Visas 






?P!£.m|JOJ.>K 






I I i P I I I I t-t c:.- ■ z J 



I I I I 



fill 
■ , £*! 

^^'— T ^T' i I I 






H.-l 



1 I | I I 



2T 





iMJH 3 Id vis 

lHWlJH'|i"«J «» 



Jf V'S-uqiO m$ 



r-r 


Mil 


1 


1 


'-< 


1 / 


4 


^z 


f-7 f . r ?Hi 

HIHJ.JO UKUfWJt, ' 


"\<*S.- 


illiwflw^.- 


1 


1 


~~i 




^ 




">■ 


- _ " 


L 


h 


L. 


1 


i i 


. L ' 


J 


"VA 




'. ■ -< 





E] 

if 






1 





Visitation Visas 
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1 ' ^WVy"/ 1 ^'^/'/ 
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'i i i f i 
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I I J I W ' T 



ptcj*H ijn i-" rJj a 
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2T 



eiio-i&oi "tJijwo 



uqui,. N iFkmUX] 



PET NAME; T 5YSTEH5 INC 
PET #: $fft-0S-l£&-5i<ft0 
PET EXP DATE: 30 SEP 2006 
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Visitation Visas 
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Visitation Visas 
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IDs/Licenses 



IDs/Licenses 



™ DRIVERS LICENSE 
^^^E^K expires n -28 ■ 20 1 o 

lN 
GUMMING £A 30040- W* 

** , ^^2BH^ %*-02 200A OSS 



ME.KSH1 WEIGHT CSL 

W\ 106 64 

CLASS ENDORSEMENTS 

c 



Fit BfllMCIKWt 

020 00 
TYPE 
REG 




State of North Carolina 



**-' 



#i !/■■ 



» „ _ ^ 



DRIVER LICENSE 



COLFAX NC 27235-9726 



-tess C andtttt M None 

ssued 06 22 2000 expires 06-30-2005 
t. M M 6-02 eve-. BLU hmr BLO rax. 






^*m*c+ 



PHILIPPINES 



^ 



DRIVER S LICENSE 



MiLLENNIUM 



GUMMING GA 30040-7176 



M 



S-04 

CIA« 

C 



fxAMOAU CQUNIY 

12 06 2005 06S 

cac fee Kiimcnom 

I 44 020 00 

ENDC)»IMINK TYPf 

REG 



ftlOTMfoATF 

J, 

WEIGH! 

136 




REPUBLIC OF THE PHILIPPINES 

DEPARTMENT Of TRANSPORTATION 1 GOMMUMCATtOHE 
LAND- TRAHCPOATATlOH Of PKE 

cast aw QuezoNcrrv 

PROFESSIONAL 



n 



LWTWAAg, MJOOLE HAMf 

. RONCHIE 




ADOPES& m~ -.m — 

TAGLESVILLE CAPlTANGAN ABUCAY 

6WTH0ATE SEX HT.{cmi WT |feq| KA" 

■ ^ ■N T 1 M 170 55 F1L 

weTwcTiow eowrtow acv empires 

123 C02 2011 



dS^ 



SIGNATURE. OP LICENSEE 
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3RIVERS LICENSE 



GUMMING GA30C40-73. 

ftlRTMOATt W 

HEKSHl WEIGHT CSC I 

CLASS ENDORSEMENTS 

c ' 



5£K 

F 




State of North Carolina 



EXAS 



DKIV1 



'ENSE 



!ju: — ^ ^L;,^ 



DEPABTMEN I Of JH BI IC SAFETY 
1R1H 

HT:5-05 
EXPIRES: 10-24-08 EYES: BRN 
REST: SEXiF 



CJ 



CLASS: C 





i 2 M 2005 OS* 



CLAM INDOMfMlNIS 



HI 



SIGNATURE OF LICENSEE 



I 



None 
ires 06-30-2005 

U h.wBLO ratx.- 



'RNES 

*tl*K ATTOHB 



.L 



UN., PROVINCE) 

Om ABUCAY 

WTlkaf HA' 

55 F1L 

MN 
C02 2011 
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IDs/Licenses 
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vinvs d«v 
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Las Vegas Metropolitan 
Police Department 
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Passports 
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Passports 




Passports 




N « UfldibrlfrmrtoJnq 



^>**V-»£V»^ 



M VICTORIA CAH^ 

^mT^FEV 09 (*LGAftT SOUTH 



16 FEB /F^V 













Passports 




, - ■- <•■ Jl<il*. ». ^Uiil 



^i^/i AftSSEPOBT 



^ 



P<CANf -i*N<:^B 



CANADIAN/CM 

a* rf> ■ fMI' »» NH 

3 91 J* 

M V J CTO 

16 = £B f*£v 
t6 FEB /F^V 






^ 



CANADlA-NfCAMftlCNNf 

I 5A5KATDDN t * '. 

14 NAff ZMARf OS SASKATOQIf 

14 HAR /HAR5 13 7i * ,v ^ 

_ _ - „.., :r ...,-,.. ..,,.•,■;•;* 



i.rrlrf rr^nji"j Wi'jj kx /i" nut iMMiilii h> f« 



firm p&t 4^ pi '■' «" ' "■'*1 trntwcit/T T-p&rttln Jc Lit 



*?.<»«*„ 



El' '.r.Tld^.i i-V i iW. i*f Jh CjJjJm ti-ifttfcut. l — '..*p-' r.V- '■■'■' ^Iftriu « dgjg 



NOT VALID UH ,_ WGHitO 



••ja L f- ^' J^.^v g ^-1 iiatiMlitiUfl^ 




NH 1= fill 



NCWTfOMK UiJL 
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|H V I CTO 
16 FEB /FEV 
16 FEB /F^V 



Passports 



no 



-LIFE 



BBBB 

PICK -AXE!! PICK- AXE !! 
BABY SEALS MUST DIE! 
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'filit 4 

IJII Hi! 

■ B 1 51 Ej - - .. - 
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...and the coup de grace 



The sad tale of Mr. N 



r* 



Decent student, 



1 

1 

1 


iiniitry of Higher Education 
at Scientific RtlMrth 

undation of Technical Education 

ate .' 

This ii to certify Hial Mr, V^ 


^*!*J1 ^Jlgi JibJl ^l^Jl ijl>j 

- 

Tu / Whom H may ton tern A ^- 
ul^*c |-i|-*-nL_r,i.-;h '^ ;ri;iru-.l tbovt la :i Bradwtfl Dt 


[be CWfcfC «f lltalili and Medical iWkfiifcgy / ISaj^Jad t«d awarded tJie d L -groc o-l" Biwhchir uf 
MfdioiJ T^hnr»l<iRv in AnjmlltLsu - AniKHtlireia Tech. Itepi. <jh lfflrtMK rtl" Llie Shi ah^mpt wilh 

■ -. ::i,!.:i.i i \'ti\ gnudMrul Ivli'v iire lL:- jr^U-Kil'ji u'R(.i n..'.l il-.i-nv . thri |oi:t yi"i--. ufsEudv 4fo 
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1. Tilt gradual? .u-tjinrt-c* 
•>. \-> rrfri^ Hi rr-,i[ i-Liiii 
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5. Summer Ifjlnlnj! Kiw. 
iS.Tiib- period of study hu 

a* 


UN fro 
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■li- (!■ 


1-»it bis [lnr-iourtlj jiMilmud FriMB ■ T«h»l«i (•(ciruir. 

3> c/ jtZr^ 



Wanted to help US 
forces in Iraq... 



MIMSTkY OF ISTMIOR 

{ri'fterul Din-i $amtt 0/ Travel 

And \ ,. ,•,'•• ■•'.' -.■■" rj 

Wfc.%. ... 



# * 



^ SLUB tjjj 



few 



(ml kciiistn fto ; 
Pa^ Nu : 

MiilmliHihu M ,im-i-iii(jr:i(fl: 
Nam* And Surname - 
I a i ii-L-i ami (irand 

Father's iVame : 

Mufhci and Hi-r- 

Falher'i Name : I *mri0^* 

Sf\ : Mul* 

RvliyMHi Muslim 

Occuptitmn : 

M.i s i1:il Slalus : Married 

Nationality : Iraqi 

Dateor»irth : 

PlarcufRinti : Baghdad 



JhU is ttt certify thai alxtve inftfrmulhm 
h f&iitieol with uttr Civil Register aittf 
Up fa dflte 



Cbgy */£""!> m7 



: Ja-ii fij 



;tt*4 

3 *iijb £j jti 
r Uifci^ll/iJlfjJl,>* 



...and it worked out 

well! 




DEPARTMENT OF THE ARMY 

A Con^any 4h Bigade Special Trooga BartoiW! 
SOStr. Regim&ntal Combat tea^, lOltl ".■■'■.un-v l- -■ i-un,*.,-. a--.* . -;i 
1 •$ .■ ■."<.-- f/g Fwwand Op*rating Baw Loyalty. -Iraq 

\^-ir.^jr ■■■■■! 



4 November 2(J('J6 



MEMORANDUM FOR RECORD 
SUBJECT- Letter of Reference for N, 



J.N .^ has distinguished krimsed' through outstanding performance as a combai 

inlerprelcT supporting A Company {Engineers^ 4th Brigade Special Troops Battalion from January 
2006 ihruuyh July 2006. 

2. For several years, K\ has supported Coalition Korues in ihc seccirity and safe*}' of Baghdad and 
ihc Iraqi people, He display an unparalleled level of courage on a daily babis. Not unly doe?, he 
voluntarily travel with Coalition Farces into (he mosl dangerous areas of Baghdad, lie In cs with. 
and overcomes, Fear everyday in h i s own home. N is farced to live a. secret li ft that lie must hide 
from family and friends to protect them, as well as himself, fmm lurtufr and certain death jt die 
hands of terrorists. His ]ovc of his people and his country shows no bounds as he chooses this life 
in the hopet that h i s c iTorts. can help bring peace lo hi^ homeland. 

1. S is si hard working native Iraqi who speaks English well. I lis calm, relied approach with 
local nationals while on paingl gives units he supports an edge during counter iiisuigcm-y operations. 
N has a deep eontcni for the fulure of Iraki and its people. His ability to relate to and understand 
die people of Baghdad has most certainly added a dimension to the li^n dial any nonnal Coalition 
unit would not be able to provide itself. N is a credit to the Iraqi people. His performance 
during the kvcki months was exedkot and >ii-> displays of selfless service and personal courage art 
exampfws. tor all ?o follow.. N is a good man, a «ood friend, and would make an 

upstanding U.S. citizen. 



But at a high price... 




"...is forced to live a 
secret life that he must 

hide from family and 

friends to protect them, 

as well as himself, from 

torture and certain death 

at the hands of 

terrorists" 



.-.■■• H ■•■ ■ 
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t KiVMnibs 3M4 



HLMUKANLH. 11 I I *i Kt t • i|l | ■ 
SUBJECT; ItatftttSetaavttst*** 



SM.*f^>rtiJui:, :ixt. 

: i i.. w -' .<: M-.i-- L h- >.- 1-.- -p.! i ..iin-i- !-:-.-m., aem hyi ,i -.!•■■. ,i:i.-it-.i ...i 

ily; li*;i pe«f fe. lie dupUyi it. .rfiparaJk ltd l**rt iircourijtt mi Jdulybfeu. NtCuily dimfe 
LiHurun^ n>^7i*nhCi^Kko fm-em*i>tlH»™ dimerau nti a\ B*^f1*J, he luti -milt, 

"» "imim^ Rtf irrTiMkj. wt hit ..-rm hmr= K..,_ ** famj |n fr| , jft-^ lifr tJlK l)C mUH hid* 

■ I '■:-,: ■-.' !•• (■:■■:.■. n i- ^..- 1 j'. --i' :!:• .:i :.. I .:■.-..,'. pfein ...■ ili. .1: :; ■ 

hmli ■:•!' WKtiiu. Ha ltw ol' hii jrGipit md lu county ibum *io toufida u he ctotM Ah Mfc 
:r I he hopo llul In-. fffrrlt h -jn -,-i^lrn,! w+:( m h'i twnwltnfl 

1 N iiitajTHrfkirnfruJi-.cLr^iwk-ifraksl nflnh^H. ||» catol, ntnsd ¥P4Twfc Wl4 

local rMtonil* while mi pacol avti nrrr> Ik- MfpMU n «1 F dLusng utmiio hnuigcm 
NT liiiiikcpninvn^t-f *irfntt«fi|'|rH]H>lilip«fte. HBlt4lJOK.nHKtK.fcl 
llM fUCffc ct'BqgM^ h» m,r* .^mVadid . d„w»i™> h, Ihf H^ dm »m w-Ul GhU« 
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A bit about ethics... 



Do the folks features here 

know that they are sharing 

this information? QJfflSfflj'o 03 DME ID@o 

In most cases, we don't think 

that they do... WM^l • * '^ 

Where we have all of the 
appropriate information, we 
have/are in the process of 
contacting all of the "victims" 
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The Cactus Project 



We wanted a tool that would do a bunch of these searches 
without intervention 

Here's a list of the features we're currently including in our 
tool 



User Defined interval based repeated searches 
Repeatable, modifiable search terms 
Automatic downloading of positive search results 
Limit by IP range for specific customer engagements 
Additional support for other P2P protocols 
Future releases to include 

• Pull from the ENTIRE gnutella mesh 

• Monitor all mesh search terms 
Here's the initial release of the tool: 




http://www.pauldotcom.com/cactusproject.html 



The Cactus Project 



Understanding gnutella protocol 
== understand the project 

Finding best of "breed tools" 

Writing tools to fill in gaps 
where needed 



Maybe develop a whole 
framework? 



http://www.pauldotcom.com/cactusproject.html 




Best of breed so far 

mutella 

• Auto re-search 
(RequeryPeriod) 

• Auto download 

• Auto compare for the 
downloads! 

• Smarter filtering pre download 

• One problem, it's a line net 
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Gnutella Protocol 
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it's an odd protocol 
ping/pong 



A HUGE COMEDY WITH TINY 
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Gnutella's saving grace 

(from our point of view) 
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It is hackable! :-D 

You know all those 
"{search term}_live.mp3" 
and "Greatest hits 
{Search term}.mp3" 

HACKED "query hit" 
responses 




Good help is so hard to 

find... 
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We know people are searching, but what 
are they looking for? 

Enter CACTUS lurker 

• Doesn't share files 

• Doesn't even download files (using 
mutella for this!) 

• Attempts to "pong'Vrespond to as 
many "ping" requests as possible 

• Records the query requests 
CACTUS filter (in development) 

• Passive listener 




Future Development 



If this gets good 
response, we'll keep 
building it 

Like it so far? 
Shmooballs? 

Contact us at 
psw@pauldotcom.com 




Conclusions 



Apparently our security education 
isn't reaching the unwashed masses 

• How do we accomplish that as an 
industry? 

Clearly, sharing too much 
information via P2P networks is way 
too easy. 

• Whether it be at home or in a 
corporate environment. 

The goods are out there... 
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